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nearo (lrreguiar^j) ) 


US- 

PGPUB; 

US PAT; 

EPO; 

JPO; 

DERWEN 

T; 

IBM TD 
B 


2005/09/15 
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3 


BRS 


L3 


6 


( (detect$3 or identif$6) 
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PGPUB; 
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EPO; 

JPO; 

DERWEN 

T; 

IBM TD 
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2005/09/15 
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Rev 1 d 
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BRS 


L4 


6480 


( (detect$3 or identif$6) 
neaij anomaly/ 


US- 

PGPUB; 

US PAT; 

EPO; 

JPO; 

DERWEN 

T; 

IBMJTD 
B 


2005/09/15 
m ♦ a q 
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BRS 
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1 


14 and (protocol adj 
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US- 

PGPUB; 

USPAT; 

EPO; 
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us- 

PGPUB; 
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EPO; 

JPO; 

DERWEN 

T; 

IBMJTD 
B 


2005/09/15 

U / . ID 


Rev'd 

kwic/imag 

es 


7 


BRS 


L7 


470 


( (detect$3 or identif$6 or 
determin$3) with 
( (abnormal or strange or 
irregular$5) near 3 
(network or protocol))) 


us- 

PGPUB; 

US PAT; 

EPO; 

JPO; 

DERWEN 

T; 

IBMJTD 
B 


2005/09/15 

1 1 • *37 


Rev'd 


8 


BRS 


L8 


317 


17 and @ad<"20020208" 


us- 

PGPUB; 

US PAT; 

EPO; 

JPO; 

DERWEN 

T; 

IBM TD 
B 


2005/09/15 
Oft • 1 ^ 


Rev'd 

kwic/imag 

es 
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BRS 


L9 


2 


"stateful signature 
detection" 


us- 

PGPUB; 

US PAT; 

EPO; 

JPO; 

DERWEN 

T; 

IBM_TD 
B 


2005/09/15 

Oft • 1 9 


Rev'd 
kwic/ imag 
es 


10 


BRS 


L13 


35 


(compar$3 or match$3) with 
packet$l with (attack adj 
signature$l ) 


us- 

PGPUB; 
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EPO; 
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US- 

PGPUB; 

USPAT; 

EPO; 

JPO; 

DERWEN 
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IBM TD 
B 


2005/09/15 
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Rev'd 
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BRS 


L15 
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"protocol anomaly 
detection " 


us- 

PGPUB; 

USPAT; 

EPO; 

JPO; 

DERWEN 

T; 

IBM TD 
B 


2005/09/15 

HQ • 1 1 


Rev'd 
kwic/ imag 
es 


13 


BRS 


L18 


6 


( (detect$3 or identif$6 or 
determin$3) with 
(abnormal$5 or 
1rregu.-L.ar9D; witn ( ruie^i 
or specif ication$l) with 
(Internet or protocol)) 


US- 

PGPUB; 

USPAT; 

EPO; 

JPO; 

DERWEN 

T; 

IBM TD 
B 


2005/09/15 


Rev'd 
kwic/ imag 
es 


14 


BRS 


L19 


490 


116 and @ad<"20020208" 


us- 

PGPUB; 

USPAT; 

EPO; 

JPO; 

DERWEN 

T; 

IBM TD 
B 


2005/09/15 


Rev'd 

luldycb 


15 


BRS 


L20 


21 


( (detect$3 or identif$6 or 
determin$3) with 
(abnormal$5 or 
irregular$5) with 
((Internet or network or 
protocol) near6 (rule$l or 
specif ication$l) ) ) 


us- 

PGPUB; 

USPAT; 

EPO; 

JPO; 

DERWEN 
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((detect$3 or identif$6 or 
determin$3) with 
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irregular$5) with (rule$l 
or specif ication$l) ) 


us- 

PGPUB; 

USPAT; 

EPO; 

JPO; 

DERWEN 

T; 

IBM TD 
B 


2005/09/15 

n Q ■ A Q 


Rev' d 
images 


17 


BRS 


L21 


2 


"packet flow descriptor" 


US- 

PGPUB; 

USPAT; 

EPO; 

JPO; 

DERWEN 

T; 

IBM TD 
B 


2005/09/15 


Rev f d 

kwic/imag 

es 


18 


BRS 


L22 . 


4560 


Stor$3 with packet$l with 
( (packet flow) near3 
(descript$3 or header$l)) 


US- 

PGPUB; 

USPAT; 

EPO; 

JPO; 

DERWEN 

T; 

IBM TD 
B 


2005/09/15 
uy : ^4 




19 


BRS 


L24 


361 
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US- 

PGPUB; 

USPAT; 

EPO; 

JPO; 

DERWEN 
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2005/09/15 

r\ n . o a 

09 : z4 
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20 


BRS 


L23 
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US- 

PGPUB; 
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B 
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USPAT; 

EPO; 

JPO; 
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2005/09/15 
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((search$3 or examin$3 or 
determin$3 or detect$3 or 
identif$6) with (packet 
near3 descript$3) with 
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US- 

PGPUB; 

USPAT; 

EPO; 

JPO; 

DERWEN 
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IBM TD 
B 


2005/09/15 


Rev 1 d 

kwic/imag 
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24 
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20 


((search$3 or examin$3 or 
determin$3 or detect$3 or 
identif$6) same (packet 
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us- 

PGPUB; 

USPAT; 

EPO; 
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kwic/imag 
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25 
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PGPUB; 
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EPO; 

JPO; 

DERWEN 
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IBM TD 
B 


2005/09/15 




28 
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L32 
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stor$3 with ( (Internet or 
network or protocol) near6 
(rule$l or 

specification$l) ) with 
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us- 

PGPUB; 

US PAT; 

EPO; 

JPO; 

DERWEN 

T; 

IBMJTD 
B 


2005/09/15 
11 : 36 


Rev'd 
images 


29 


BRS 


L33 


2 


( (identif$6 or determin$3 
or detect$3) with packet$l 
with (compliant or 
deviat$3) with ( (Internet 
or network or protocol) 
near3 (rule$l or 
specification$l) ) ) ( 


us- 

PGPUB; 

US PAT; 

EPO; 

JPO; 

DERWEN 

T; 

IBM_TD 
B 


2005/09/15 


Rev ' d | 
kwic /imag 
es 


30 


BRS 


L34 
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({identif$6 or determin$3 
or detect$3) with packet$l 
with (compliant or 
deviat$3) ) 


US- 

PGPUB; 

US PAT; 

EPO; 

JPO; 

DERWEN 
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IBM TD 
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2005/09/15 
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Rev ! d 
images 
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1 
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us- 

PGPUB; 

US PAT; 

EPO; 

JPO; 

DERWEN 
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Rev'd 
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es 


32 


BRS 


L36 
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"20030105976". pn. and 
(signature$l near3 
database) 


us- 

PGPUB; 

US PAT; 

EPO; 

JPO; 

DERWEN 

T; 

IBM TD 
B 


2005/09/15 


Rev'd 

kwic/imag 

es 


33 


BRS 


L37 
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"6499107". pn. and 
(signature$l near3 
database) 


US- 

PGPUB; 

US PAT; 

EPO; 

JPO; 

DERWEN 

T; 

IBM TD 
B 


2005/09/15 

11.47 
X -L • 4 / 




34 


BRS 


L38 
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"6499107". pn. and 
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US- 

PGPUB; 

US PAT; 

EPO; 

JPO; 

DERWEN 
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IBM TD 
B 


2005/09/15 

11.4/ 


Rev'd 
kwic/ imag 
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35 
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finite automation") near3 
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us- 

PGPUB; 

US PAT; 

EPO; 

JPO; 

DERWEN 
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IBM TD 
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2005/09/15 


Rev 1 d 
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"20030105976" .pn. and 


US- 

PGPUB; 

USPAT; 

EPO; 

JPO; 

DERWEN 

T; 

IBM TD 
B 


2005/09/15 

1-3.17 
JL.O . X f 


Rev f d 

kwic/imag 

es 


37 


BRS 


L4 3 
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("20030105976", 

"6499107") .pn. and alarm$3 

and log$4 


US- 

PGPUB; 

USPAT; 

EPO; 

JPO; 

DERWEN 

T; 

IBM TD 
B 


2005/09/15 

1 A • 

1 H . O 0 


Rev'd 

kwic/imag 

es 


38 
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L44 


2 


("20030105976", 

O *i _7 j ± \J 1 ) . jJll . dim o U<J I. y O 
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PGPUB; 

USPAT; 

EPO; 

JPO; 

DERWEN 
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IBM TD 
B 


2005/09/15 
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es 


39 


BRS 


L45 
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("20030105976", 

"6499107") .pn. and (stor$3 

policy) 


US- 

PGPUB; 

USPAT; 

EPO; 

JPO; 

DERWEN 

T; 

IBM TD 
B 


2005/09/15 

_LO . Z / 




40 


BRS 


L46 
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("20030105976", 

"6499107") .pn. and (stor$3 

near3 policy) 
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PGPUB; 
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EPO; 
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T; 
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2005/09/15 
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("20030105976", 

"6499107") .pn. and (stor$3 

with policy) 


us- 

PGPUB; 

USPAT; 

EPO; 

JPO; 

DERWEN 

T; 

IBM TD 
B 


2005/09/15 




42 


BRS 


L48 


2 


("20030105976", ■ 
"6499107") .pn. and 
administrat$3 


us- 

PGPUB; 

USPAT; 

EPO; 

JPO; 

DERWEN 

T; 

IBM TD 
B 


2005/09/15 

i *a • a t; 
lo : 4o 




43 


BRS 


L49 
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("20030105976", 
"6499107") .pn. and 
administrat$3 and (GUI or 
"graphical user 
interface" ) 


US- 

PGPUB; 

USPAT; 

EPO; 

JPO; 

DERWEN 

T; 

IBM TD 
B 


2005/09/15 




44 
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L50 


0 


"6453345". pn. and (stor$3 
with policy) 


US- 

PGPUB; 

USPAT; 

EPO; 

JPO; 

DERWEN 

T; 

IBM TD 
B 


2005/09/15 
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45 


BRS 
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US- 

PGPUB; 

USPAT; 

EPO; 
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B 


2005/09/15 
14*97 





9/15/05, EAST Version: 2.0.1.4 





Type 


L # 


Hits 


Search Text 


DBS 


Time Stamp 


Comments 


46 


BRS 
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1 


"6453345". pn. and alarm$3 
ana xog9fi 


us- 

PGPUB; 

US PAT; 

EPO; 

JPO; 

DERWEN 

T; 

IBM TD 
B 


2005/09/15 
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47 


BRS 


L54 
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(central adj server) with 
stor$3 ( (network or 
security) adj policy) 


us- 

PGPUB; 

US PAT; 

EPO; 

JPO; 

DERWEN 

T; 

IBM TD 
B 


2005/09/15 

J. H . 3 1 




48 


BRS 


L57 


44 


154 and (distribut$3 with 
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us- 

PGPUB; 

US PAT; 

EPO; 

JPO; 

DERWEN 

T; 

IBM TD 
B 


2005/09/15 
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Rev'd 
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49 
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